Female Virus Writer Attacks Her Fellow Coders

Sophos experts have advised customers about a new email-aware worm that has an unusual payload. Not only does it attempt to disinfect computers of another worm but it also contains a message disparaging another virus writer.

W32/Sahay-A is an email-aware worm that spreads via a screensaver called MathMagic.scr. If users run the attachment it drops a file called yahasux.vbs onto the hard drive which then forwards the virus onto everyone in the Windows address book. The virus goes on to attempt to disinfect any infections of W32/Yaha-K it may find. However, due to bugs it may fail to do this correctly.

W32/Sahay-A appears to be written by the female virus writer Gigabyte, believed to be based in Belgium. In the past Gigabyte has gained herself considerable notoriety by being a rare example of a female writing viruses in a pastime dominated by young males.

In a clear indication that the virus writing community is not united Gigabyte has contained the following message inside her virus:

Hi there.. it seems you were infected with Yaha.k. That worm however, written by an idiot who sPeLlS lIkE tHiS, abused my website and got me to receive the complaints. Therefore, I have just disinfected you. Don’t worry tho.. as I didn’t wanna steal from you, I gave you this virus (Win32.HLLP.YahaSux) in return 🙂

Greetz,
Gigabyte [Metaphase VX Team]

“This virus does not appear to be particularly widespread but protection is already available for Sophos customers,” said Graham Cluley, senior technology consultant for Sophos Anti-Virus. “It’s interesting to see virus writers having quarrels with each other – it’s just a shame they choose to have their arguments on the computers of innocent users rather than over a pint of beer down the pub.”